Skip to content

zelentsov-dev/asc-mcp

v3.7.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-tools app-store-connect claude in-app-purchase ios macos
+6 more
mcp model-context-protocol subscriptions swift testflight xcode-cloud

Summary

AI summary

Failed MCP tool calls now return a canonical structured error shape with success:false, stable error message, and details.

Full changelog

[3.7.0] - 2026-07-20

Changed

  • Failed MCP tool calls now expose a canonical structured result with success: false, a stable error message, and details, while retaining the first human-readable text block.
  • Error results preserve content annotations, non-text content, and MCP _meta, and append exactly one compact JSON text mirror for clients that do not consume structuredContent.
  • Typed output schemas for apps_list, apps_search, apps_get_details, and webhooks_verify_signature now admit the canonical error shape without changing their successful result fields.

Fixed

  • Normalize direct worker errors and converted thrown errors at the central WorkerManager transport boundary so all 390 tools return consistent machine-readable failures.
  • Redact sensitive error values before transport while preserving semantic identifiers and stable redaction markers across repeated normalization.
  • Return canonical structured errors from the three apps_get_metadata no-version, missing-state, and missing-localization paths instead of embedding an entire JSON object inside the error string.

Compatibility

  • No public MCP tool or input was added, removed, or renamed; successful tool results remain unchanged.
  • Error results retain their first human-readable text block and may now include an additional compact JSON text mirror plus structuredContent; clients assuming exactly one error content block should select the first human block or consume structuredContent.
  • The strict contract pin remains unchanged at 2,154 optional Apple inputs: 730 bound, 6 internally controlled, 1,010 intentionally omitted, and 408 still queued for domain review.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track zelentsov-dev/asc-mcp

Get notified when new releases ship.

Sign up free

About zelentsov-dev/asc-mcp

App Store Connect API server with 208 tools for managing apps, builds, TestFlight, subscriptions, reviews, and more — directly from any MCP client.

All releases →

Related context

Earlier breaking changes

  • v3.1.0 `app_versions_set_review_details.attachment_file_id` replaced by separate `review_attachments_upload` call.
  • v3.1.0 Moved app-level TestFlight contact and policy metadata from `builds_set_beta_localization` to corresponding `beta_app_*_localization` tools.
  • v3.1.0 `builds_update_beta_detail` no longer accepts read-only fields `internal_build_state` or `external_build_state`.
  • v3.0.0 Removed public prefixes `offer_codes_*`, `intro_offers_*`, `promo_offers_*`, and `winback_*` from v3 worker schema.

Beta — feedback welcome: [email protected]